SY0-701 Security Architecture Practice Question
An online retailer is redesigning its public web application so the web server can receive internet traffic, the application server can only be reached by the web tier, and the database server can only be reached by the application tier. Which placement best supports this design?
⚠ Common exam trap
It's easy for candidates to confuse 'private subnet' with 'security' and fail to recognize that without network segmentation, a single compromised server can lead to full lateral access, or they mistakenly think placing the database in a public zone is acceptable for direct queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.
It implements a classic three-tier architecture with network segmentation. The web server in a public zone (DMZ) accepts internet traffic, the application server in a private zone is isolated from direct internet access and only reachable by the web tier, and the database server in an isolated internal zone is only reachable by the application tier. This design enforces the principle of least privilege and minimizes the attack surface by using firewalls or security groups to restrict traffic between tiers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Place all three servers on the same private subnet and control access only with strong passwords.
Why it's wrong here
Placing all three servers on a single private subnet collapses the trust boundaries between web, application, and database tiers. If the web server is compromised—for example, via an unpatched application bug—the attacker can use lateral movement to reach the database without crossing a firewall or ACL. Strong passwords only protect accounts at the application layer; they do not block network-level attacks, packet sniffing, or direct exploitation of services on adjacent hosts. Proper security requires separate segments with controlled traffic flows, not a flat network with weak authentication as the only defense.
- ✓
Put the web server in a public zone, the application server in a private zone, and the database server in an isolated internal zone.
Why this is correct
This tiered placement supports a classic defense-in-depth design. The web server is internet-facing, the application tier is not directly exposed, and the database is placed in the most restricted zone. Network rules then allow only the necessary north-south and east-west traffic between tiers.
- ✗
Put the database in the public zone so the web tier can query it directly from the internet.
Why it's wrong here
Exposing the database in a public zone grants internet-facing access to the most sensitive tier, bypassing the application server and its security controls. This directly invites remote attacks such as SQL injection, brute force, or scans for database service vulnerabilities, and any misconfiguration can lead to mass data exfiltration even if the web tier is secure. The web tier should never query a database directly across the internet because that eliminates the protective isolation that a layered architecture provides. Databases belong in a restricted internal segment, reachable only by specific application servers on specific ports and protocols.
- ✗
Use a single reverse proxy for all three servers and disable network segmentation to simplify management.
Why it's wrong here
Using a single reverse proxy for all three servers and disabling segmentation removes the fundamental security boundaries that prevent lateral movement. A reverse proxy is a traffic mediator—it can handle TLS, load balancing, and caching—but it does not separate the web, app, and database tiers into zones with different trust levels. By disabling segmentation, you allow an attacker who compromises any one server to freely access all other servers and data stores on the network. Security in depth demands both network segmentation and proxy-based edge protection, not treating one as a substitute for the other.
Go deeper
Related to this question
Learn chapter
Network Segmentation and Isolation
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
DMZ
A DMZ (demilitarized zone) is a network segment that sits between an internal private network and the public internet, hosting publicly accessible services while keeping the internal network isolated.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A web application must be reachable from the internet, but its database should be isolated from direct internet access. Which two placements or controls are most appropriate? Select two.
easy- ✓ A.Place the web server in a DMZ.
- ✓ B.Keep the database on an internal network segment and restrict access to the web server only.
- C.Place both the web server and the database on the same internet-facing subnet.
- D.Expose the database port to the internet so administrators can connect faster.
- E.Use the guest wireless VLAN for both systems.
Why A: Placing the web server in a DMZ (Option A) allows it to be reachable from the internet while the internal firewall restricts inbound traffic to only necessary ports (e.g., TCP 80/443). Keeping the database on an internal network segment (Option B) and configuring firewall rules to allow traffic only from the web server’s IP address ensures the database is isolated from direct internet access, preventing external attacks on the database service.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.